Openfang
Monthly
Uncontrolled memory allocation in RightNow-AI OpenFang up to version 0.6.9 allows remote low-privileged attackers to degrade or crash the service by sending crafted input to the shell_exec function in the openfang-runtime crate. The CVSS 4.0 vector (AV:N/PR:L/VA:L) confirms network-reachable, authenticated exploitation with limited availability impact and no confidentiality or integrity exposure. A public proof-of-concept exploit is available on GitHub (CVE/OpenFang_ShellExec_Output_Buffer_DoS_Report), and the vendor did not respond to disclosure - no patch has been released.
Uncontrolled memory allocation in RightNow-AI OpenFang up to version 0.6.9 allows remote low-privileged attackers to degrade or crash the service by sending crafted input to the shell_exec function in the openfang-runtime crate. The CVSS 4.0 vector (AV:N/PR:L/VA:L) confirms network-reachable, authenticated exploitation with limited availability impact and no confidentiality or integrity exposure. A public proof-of-concept exploit is available on GitHub (CVE/OpenFang_ShellExec_Output_Buffer_DoS_Report), and the vendor did not respond to disclosure - no patch has been released.